Public sector fleets: a guide to tender specs

Public procurement of fleet management software has an added difficulty compared with private purchasing: the tender specifications are written once, they’re binding for years, and any poorly drafted clause ends up as an operational problem or an objection from the Interventor (the public body’s internal comptroller). This guide brings together the criteria we’ve seen work in midsize city councils, provincial councils (diputaciones) and regional government vehicle pools, with a focus on what shouldn’t be missing and what’s best avoided.

It isn’t a formal template, and it doesn’t replace legal advice from the relevant procurement unit. It’s what a technical lead should ask for before signing off on tender specifications that are about to go out to bid.

Non-negotiable requirements

There’s a group of clauses that shouldn’t be scored but should act as an exclusion threshold: either they’re met or the bidder is out. Treating these points as improvable leads to legally questionable bids that are then hard to award without risk.

Data hosted within the European Union

The public administration is the data controller. The provider is the data processor. Personal data (the position of vehicles assigned to employees, driver identification, tachograph data) must be hosted on servers physically located in EU territory, with an express prohibition on international transfers unless there’s an adequacy decision or appropriate safeguards under the GDPR.

In practice, this rules out platforms whose main infrastructure is in the United States without formal safeguards, and leaves as real options the providers that can prove contracts with AWS Europe, Azure Europe Region, OVHcloud or equivalent.

A written data processing agreement

Article 28 of the GDPR requires it, and the AEPD (Spain’s Data Protection Agency) enforces it. The tender specifications must require the successful bidder to sign a data processing agreement with specific clauses: purpose, duration, nature, types of data, the processor’s obligations, authorized sub-processors, return or destruction at the end of the contract.

Asking for it only as a “general commitment” leaves the contracting authority exposed in the event of a security incident.

Compliance with the National Security Framework

For systems that process public employees’ data and location, Spain’s National Security Framework (ENS, Esquema Nacional de Seguridad) applies at medium category at the very least, and in some cases at high category. The provider must prove ENS certification or a declaration of conformity, with an external audit where applicable. Without this, integration with the administration’s internal systems (its e-government portal, or Sede Electrónica, and its own ERP) may be blocked by the IT security unit.

A documentary audit trail for the Interventor

The Interventor checks that spending is justified and that the service is being delivered in line with the tender specifications. This requires the platform to generate:

• Monthly usage reports per vehicle with mileage, hours in service and relevant events
• A log of incidents and their resolution
• A tamper-proof data history for the duration of the contract plus the applicable statute-of-limitations years
• The ability to export everything when the contract ends (real portability, not just “view access”)

A platform that only offers a visual dashboard, with no way to generate a signed PDF or export a detailed CSV/Excel file, won’t survive the comptroller’s first request.

Technical criteria to score

This is where scoring comes in. The relevant technical criteria for a public fleet are fewer than tender specifications usually include, but more demanding.

GPS positioning and geofencing

Positioning with a minimum accuracy of 5 meters under normal conditions, an update frequency configurable between 30 seconds and 5 minutes depending on operational needs, and support for geographic zones (geofencing) with entry and exit notifications. For municipal vehicles that operate in specific areas (social services, park maintenance, separate waste collection), this is the day-to-day operational foundation.

A detailed explanation of how virtual zones are used is in the article on fleet geofencing.

Digital tachograph support with remote download

For fleets with vehicles subject to tachograph requirements (goods transport above 3.5 t and, in many cases, passenger transport with more than 9 seats), remote download stops being optional from July 2026. The regulatory details and deadlines are in the article on digital tachographs and remote download.

The tender specifications should require demonstrable compatibility with the tachograph brands in the fleet (VDO, Stoneridge, Continental) and digitally signed files in line with the EU regulation, not just an “informational” download.

A documented, open REST API

Public administrations usually have their own systems: asset management ERPs, service planning tools, internal registries. The tender specifications should require a publicly documented REST API, with standard authentication (OAuth 2.0 or an API key) and no additional cost for reasonable usage.

Without this, any future integration becomes a development project at a fixed price set by the provider, with total dependency.

Training and support in Spanish

Initial training for the technical staff who will use the platform (fleet managers, heads of service) and support in Spanish during working hours. For administrations in regions with a co-official language, also consider support in that language if there will be regular users.

Hardware

This deserves its own section in the tender specifications. The cleanest option technically is to require hardware based on open standards (OBD-II and J1939 compatible) from a brand with an established European presence (Teltonika, for example, is Lithuanian and maintains a long-lived catalog). This avoids being tied to the software provider for future renewals or changes.

At Trackia we work with Teltonika FMM003 devices (LTE Cat M1 coverage, ideal for urban vehicles) and FMC003 devices (LTE Cat 1, more power for heavy or international fleets), plus Eye Beacon accessories (passive Bluetooth driver identification) and Eye Sensor accessories (temperature, humidity, door opening). The details are on the public sector page and in the comparison of Teltonika hardware for fleets.

Problematic clauses to avoid

These are the ones that lead to the most unfortunate contract awards, based on recurring experience.

Proprietary hardware with no alternative

Tender specifications that describe the hardware in such detail (model, specific part number) that only one provider qualifies. Besides skirting the principles of competition and non-discrimination in article 132 of the LCSP (Spain’s Public Sector Contracts Act, Ley de Contratos del Sector Público), they tie the administration to a single supplier for the next 4-8 years.

The correct wording describes the hardware’s performance requirements (coverage, parameters it must read, required certifications, minimum warranty), not a specific brand or model.

Multi-year minimum terms with no way out

Service contracts of 3-5 years with no reasonable exit clause. If the service fails, the contracting authority is stuck or has to start termination proceedings for breach, which are long and risky.

What’s reasonable is a 1-2-year contract with annual extensions and a termination clause for objectively measurable breaches: service outages above X hours per month, systematic support delays, failure to deliver reports.

“Future modifications” with no cap

Clauses such as “modifications to the service may be agreed during the term of the contract” without defining a maximum amount or specific grounds. Besides the legal risk (the LCSP limits contract modifications), it opens the door to cost overruns during execution that the Interventor will object to.

Unilateral penalties imposed by the provider

Clauses that allow the provider to cut off service for non-payment in fewer than 60 days, or to raise prices annually in line with CPI with no cap. Public administrations have their own payment terms that the provider must accept, and price reviews must follow a transparent formula with a ceiling.

Sample template of sections

A technical specification structure that covers all of the above, as a starting point:

1. Purpose: definition of the service (fleet management platform + hardware + support + training)
2. Minimum technical specifications: non-negotiable requirements (GDPR, ENS, EU data, audit trail)
3. Scored functional capabilities: positioning, geofencing, tachograph, maintenance, API
4. Hardware: performance, certifications, warranty, installation
5. Support and training: hours, language, response times, initial and ongoing training
6. Terms and pricing: initial duration, extensions, exit clause, price review with a cap
7. Penalties for non-compliance: defined and objectively measurable
8. Documentation to be delivered by the successful bidder: data processing agreement, certifications, manuals

And as annexes: scoring criteria with percentage weights, a financial bid form, a responsible declaration.

Help drafting tender specifications

At Trackia we’ve worked with several procurement units to review draft tender specifications from the technical side, free of charge and with no commitment to bid afterwards. The idea is for the specifications to be well drafted even if another provider ends up winning, because poorly drafted specifications hurt the whole administration.

If you’re preparing a tender, write to us through the contact form with an initial draft and we’ll send you technical comments within 5-7 business days.